The packages

The framework is split into five npm packages, all published under the @drawnagency scope. Client repos depend on whichever packages they need — typically all five.

Dependency graph

primitives        (leaf — no internal deps)
├── authoring      (depends on primitives)
├── github         (depends on primitives)
├── auth-supabase  (depends on primitives)
└── core           (depends on primitives + github)

Publish order follows this graph: primitives → authoring → github → auth-supabase → core. Use bash scripts/publish.sh from the monorepo root — never publish packages manually.

Package reference

@drawnagency/primitives

The shared foundation. Contains:

• Zod schemas for all section types, index.json, site-config.json, and image manifest.
• Section component registry — defineSection(), registerSection(), getSectionSchema(), and the Symbol.for-keyed singleton registry.
• React section components — the rendered UI for every built-in section type.
• mergeSiteContent() and loadStaticSiteContent() — the core content assembly functions.
• Auth capability helpers — deriveUiCapabilities() and related types.

No internal @drawnagency/* dependencies. Safe to import on its own.

@drawnagency/authoring

The content-population toolchain. Contains:

• The authoring CLI (validate, process-images subcommands).
• The /populate-site Claude skill, linked into client repos via postinstall → link-skills.mjs.
• Image processing pipeline (download → WebP conversion → manifest update).

Depends on @drawnagency/primitives for schema validation during validate.

@drawnagency/github

The GitHub storage client. Contains:

• createGitHubClientAsync() — instantiates an Octokit client authenticated as the GitHub App installation.
• Helpers for reading/writing files, listing branches, and getting commit SHAs from a client repo.
• owner, repo, branch constants resolved from environment variables.

Depends on @drawnagency/primitives.

@drawnagency/auth-supabase

The Supabase authentication adapter. Contains:

• supabaseAuth() — returns an AuthProvider implementation backed by Supabase Auth.
• Session resolution, audience CRUD, user management, and password-auth toggle — all routed through Supabase.
• OAuth PKCE flow helpers.

Depends on @drawnagency/primitives for the AuthProvider interface and shared types.

@drawnagency/core

The Astro integration and everything that ties the framework together. Contains:

• defineConfig() (from @drawnagency/core/config) / portalIntegration() — the Astro integration that registers routes, sets up noExternal, creates .portal/ symlinks for dev mode, and wires virtual:portal/* modules.
• Astro pages: viewer index, /edit, auth API routes, media API route.
• packages/core/src/middleware.ts — the dual-path auth gate.
• loadContentFromGitHub() and loadMediaManifestFromGitHub() — GitHub-backed loaders built on @drawnagency/primitives’ mergeSiteContent().
• Password-only auth adapter (lib/password.ts) as an alternative to Supabase.

Depends on @drawnagency/primitives and @drawnagency/github.

Version constraints

All packages use 0.1.x versions. Client repos reference them with ^0.1.0 ranges, which under semver 0.x rules means >=0.1.0 <0.2.0. Bumping to 0.2.0 in any package requires client repos to explicitly widen their range.

Workspace dependencies in the monorepo use workspace:* (or workspace:^). pnpm publish resolves these to real version numbers at publish time — npm publish does not and will break consumer installs silently.